Privacy Policy

Helvaro BV. Last updated: October 2026 · Lees in het Nederlands

1. Who we are

Helvaro BV is a B2B SaaS platform that helps businesses (such as car dealers and estate agents) follow up their enquiries over WhatsApp, e-mail and a chat window on their own website. Contact us at hello@helvaro.pro.

2. What data we collect

• Name, phone number and/or e-mail address (through a contact form, the chat window on the business's website, WhatsApp or e-mail). An e-mail address or a phone number is enough.
• The WhatsApp messages you exchange with our AI assistant, including the full conversation history
• Messages you send in the chat window on the business's website
• E-mails you send to the business, with their attachments, if that business has connected its mailbox to Helvaro
• Which vehicle or property your question is about, and any appointment that follows
• Whether you agreed to be contacted, and whether you opted out
• An AI-generated qualification score and summary of the conversation
• Your IP address is used briefly to prevent abuse (for example too many requests in a short time) but is not stored in our database

We only use your e-mail address if you give it yourself or e-mail the business, and only to answer your question. Without your separate consent you receive no advertising or newsletters.

3. What we use your data for

Your data is used to contact you, to answer your question through our AI assistant (on WhatsApp, by e-mail or in the website chat window), and to determine whether there is a match with the services of the business you contacted. We never sell your data to third parties.

4. Fraud prevention when a new customer signs up

This section does not apply to leads but to businesses that create a Helvaro account through our sign-up page.

To prevent abuse of our free trial (mass-created trial accounts, bots, competitor probing) we collect a few additional technical signals at sign-up:

• IP address of the device used to sign up, to limit the number of sign-ups per IP address and to get an indication (via a reverse DNS check, without any external service) whether the address belongs to a hosting provider rather than an ordinary internet connection.
• Device/browser fingerprint: a technical, non-identifying hash based on browser characteristics (screen resolution, language, time zone) used to detect the same device creating several accounts in quick succession.
• The e-mail address, e-mail domain, company name and phone number you enter yourself, compared with our existing customers to recognise duplicate trial accounts.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in preventing abuse, fraud and automated sign-ups and in protecting the quality of our service.

What never happens: this check never leads to an automatic rejection. The system can approve a sign-up automatically or flag it for manual review, an actual refusal only ever follows human assessment. Not having a (findable) website is never by itself a reason to flag or refuse a sign-up.

Retention: the IP address and device fingerprint are only useful at the moment of sign-up and are therefore deleted automatically after 30 days by the same daily clean-up job that anonymises cold leads (see section 5). The outcome of the check (a score and the reasons used, without the IP address or fingerprint) is kept longer as an internal record of why an account was approved or flagged.

5. How long we keep your data

Your data is kept for as long as necessary for the purpose it was collected for, or until you ask for deletion. Concretely:

• Qualified leads (where a customer relationship was or may still be established) are kept for as long as that relationship requires.
• Unqualified or cold leads with no activity for 6 months are anonymised automatically: name, phone number and the full conversation content are deleted. Anonymised statistics that cannot be traced to a person (number of leads, conversion rates) are kept for reporting.
• Sign-up fraud-prevention signals (IP address, device fingerprint, see section 4) are deleted automatically after 30 days.

You can request earlier deletion or anonymisation of your data at any time, see sections 8 and 8b.

6. Who processes your data

Besides the business you contact directly, Helvaro relies on the following parties (sub-processors) to deliver the service:

• Anthropic PBC (United States), processes the content of your conversation (WhatsApp, chat window or e-mail) to generate the AI replies.
• Meta Platforms Ireland Ltd., carries the message traffic through WhatsApp Business.
• Vercel Inc. (United States), hosting and execution of this application.
• Airtable (Formagrid Inc., United States), the database in which your lead and conversation data is stored.
• Namecheap Private Email (SMTP, via hello@helvaro.pro), sends notification, verification and password-reset e-mails.
• Stripe Payments Europe, Ltd. (Ireland, with processing in the United States), processes customer subscriptions and payments. Customer accounts only; leads never appear here.
• Google Ireland Ltd., calendar integration: when a customer connects Google Calendar, appointments that follow from your conversation are created there (your name and the time of the appointment). And when a customer connects a Gmail or Google Workspace mailbox: the e-mails you send to that customer, and the replies.
• Microsoft Ireland Operations Ltd., only when a customer connects a Microsoft 365 or Outlook mailbox: the e-mails you send to that customer, and the replies.
• OneSignal, Inc. (United States), sends push notifications to the customer's device about incoming leads. Processes no message content.
• Clerk Inc. (United States), handles sign-in to the dashboard. Processes the e-mail address, the (hashed) password and technical sign-in data such as IP address, browser and sign-in times. Customer accounts only; leads never appear here.
• OpenAI, L.L.C. (United States), as a second AI model next to Anthropic, and for images a customer chooses to create. Processes the content needed for that.
• Kling AI, only when a customer chooses to create a video. Processes no lead data.
• ElevenLabs Inc. (United States), only if a customer turns on the voice assistant: the voice and the course of the phone call.
• The customer's CRM (e.g. HubSpot, Pipedrive or Salesforce), only if a customer turns that integration on: your name, contact details and the appointment are sent to that system.
• Upstash Inc. (United States), briefly counts sign-in attempts per IP address to prevent abuse. Stores no names or messages; counters expire within fifteen minutes.

This list matches Annex 3 of our data processing agreement. We keep it current and update this policy whenever it changes.

Data from Google (Gmail and Calendar)

If you connect your Google account, we only request the permissions the feature needs: read new incoming e-mail (gmail.readonly), send e-mail from your address (gmail.send), and read and create appointments in your calendar. We only read messages that arrive after you connect, not your existing mailbox. If you choose "send only", we request only the permission to send e-mail (gmail.send) and read nothing from your mailbox; we then only send the messages you write and send yourself in Helvaro. We use this data solely to provide that feature to you: showing and answering your customer conversations and scheduling appointments. We do not sell it, share it with third parties for their own purposes, use it for advertising, or train AI models on it. You can disconnect at any time in the settings; we then revoke access at Google and delete the stored access token.

Helvaro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. International transfers

Some of the parties above are established outside the European Economic Area (EEA), notably in the United States (Anthropic, OpenAI, ElevenLabs, Vercel, Airtable, Clerk and Upstash among others). For those transfers we rely on a valid transfer mechanism under the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) or, where applicable, the EU-US Data Privacy Framework, the same safeguards laid down in our data processing agreement with customers.

8. Your rights

You have the right to access, rectify, restrict, port or erase your data, and to object to processing. E-mail hello@helvaro.pro to exercise any of these rights.

8b. How to have your data deleted

You do not need an account to request deletion. This is how it works:

• As a lead (you sent a WhatsApp message to a business that uses Helvaro): send the word STOP in that same WhatsApp conversation. You will receive no further messages. If you also want your name, phone number and the conversation content deleted, e-mail hello@helvaro.pro from any address and mention the phone number you used. We delete or anonymise your data within 30 days and confirm by e-mail.
• As a customer (you have a Helvaro account): in the dashboard go to Settings → Delete account. This immediately deletes your account, your leads, conversations and appointments. You can also request the same via hello@helvaro.pro.
• Through Facebook/Meta: if you granted Helvaro access through a Meta login or connection screen, you can revoke that access in your Facebook settings under Apps and Websites. Meta then sends us a deletion request, which we handle in the same way.

Data we are legally required to keep (for example invoices) is retained for as long as the law requires; everything else is deleted.

9. Cookies and local storage

We use no analytics, no advertising cookies and no tracking pixels. What the app does set:

Strictly necessary (no consent needed, art. 129 Belgian Electronic Communications Act):

• hv_session and hv_csrf: your signed-in session and protection against forged requests. They end when you sign out or the session expires.
• __session, __client_uat and similar cookies from our sign-in provider Clerk: signing in itself.
• Local storage (hv-*): your language, project, theme and screen preferences, plus your cookie choice (hv-toestemming, 12 months). It stays on your device and is not sent to third parties.

Only with your consent:

• Push notifications through OneSignal (OneSignal, Inc., USA): a device ID and your notification preference, stored in your browser and at OneSignal. This script is only loaded after you choose “Accept all” or click “Turn on notifications” yourself.

You can change your choice at any time via “Cookie settings” at the bottom of the sign-in screen, or by clearing this website’s site data in your browser. Declining has no effect on using the app.

10. Security and storage

Your data is stored securely in Airtable and processed by this application, which runs on Vercel. All connections are encrypted with HTTPS/TLS.

11. Contact

Questions about this privacy policy: hello@helvaro.pro. For questions specifically about data protection, contact our data protection contact: sindi@helvaro.pro.